PT-2026-83629 · Unknown · Ash Graphql
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
ash graphql versions 1.9.0 through 1.10.x
Description
A remote client can read internal field names that an application configured its
error handler to redact. In AshGraphql.Errors, errors are processed by the error handler and merged using Map.put new(handled, :path, path). If a sanitizing handler returns a new map or removes the :path key, this action is reverted. The path is re-injected via the build error path/5 function, which uses raw internal Ash attribute and argument names when no field names mapping is configured. Consequently, validation failures on nested or non-exposed fields reveal internal names in the GraphQL error path.Recommendations
Update ash graphql to version 1.11.0 or later.
Exploit
Fix
Generation of Error Message Containing Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ash Graphql